Blind Eagle APT Targets Latin America With Judicial Phishing Campaign
Threat actors use fake court notices to deliver sophisticated remote access trojans.
1Resurgence of Blind Eagle
The threat actor known as Blind Eagle, or APT-C-36, has launched a new campaign targeting Latin American organizations. Active since 2018, this group utilizes phishing lures themed around judicial and administrative documents. Their primary objective involves delivering remote access trojans to compromise sensitive legal, financial, and institutional information across the region.
2Deceptive Phishing Tactics
Attackers send emails containing weaponized XHTML files that mimic official notices from entities like Colombia's Fiscalía General de la Nación. These files function as Scalable Vector Graphics, rendering fake web pages to deceive recipients. By masquerading as legitimate court or fiscal notifications, the group effectively lures individuals into opening malicious attachments.
3HTML Smuggling Mechanism
The campaign employs HTML smuggling to bypass standard email security controls. This technique allows the malware to assemble a ZIP archive payload locally within the victim's web browser using ZipCrypto. By constructing the malicious file on the host machine rather than downloading it directly, the attackers successfully evade traditional perimeter security filters.
4Payload and Reconnaissance
Inside the ZIP archive, a JavaScript dropper masquerades as Network Configuration Auditor version 2.7.298. Once executed, the script performs environment reconnaissance, gathering system versions, network profiles, and memory details. It specifically targets directories localized in Portuguese and Spanish, ensuring the malware is tailored to the operational environment of its intended regional victims.
5Evasion and Persistence
The malware executes a Visual Basic Script to bypass Windows Antimalware Scan Interface and Event Tracing for Windows. To maintain persistence, it sets up execution in the Windows Startup folder while displaying a fake criminal citation page as a distraction. It also clears Mark of the Web metadata to hide its origin.
6Advanced Trojan Architecture
The final payload is a remote access trojan that shares structural lineage with AsyncRAT and DCRat. PowerShell is utilized to decode and launch this trojan directly in memory, minimizing the forensic footprint on the infected system. Its configuration and build characteristics confirm its connection to previous operations attributed to the APT-C-36 group.
7Operational Attribution Analysis
Researchers link this campaign to a Brazilian operational cluster based on the timezone, regional victimology, and the use of Portuguese and Spanish lures. The targeting of judicial and educational organizations suggests a strategic focus on high-value institutional data. These elements collectively identify the operation as a sophisticated effort by the Blind Eagle group.
8Potential Impact and Risks
While no confirmed successful compromises were reported, the potential impact includes full remote access, keystroke logging, and screen capture. Successful exploitation allows attackers to perform extensive surveillance and data exfiltration over encrypted channels. Organizations must improve identity visibility and incident response capabilities to defend against these evolving, region-specific cyber threats.